Liebes trojaner-board,
gestern um 5 Uhr morgens hat sich mein yahoo! Mail Account selbstständig gemacht und Spam-Nachrichten an meine Kontakte verschickt. Die eMails wurden tatsächlich versandt, da sie im Sent Ordner zu finden sind.
Passwort wurde geändert und Kontakte habe ich auch gelöscht.

MSE: hat leider nichts gefunden
Malwarebytes hat den Win32/Toolbar.Zugo und nach zweimaligem Löschen kann ich die Datei nicht mehr finden (im abgesicherten Modus).
SuperAntiSpyware hat sogar 7 Sachen gefunden.

Ich habe jetzt OTL und GMER ausgeführt, beim ersten Gmer-Scan ist der PC abgestürzt und gerade eben nochmal, das System läuft instabil hab ich das Gefühl:
OTL
[CODEOTL Logfile:

OTL logfile created on: 10.06.2013 18:00:32 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Users\***\Desktop\Virenbekämpfung
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 5,94 Gb Available Physical Memory | 77,40% Memory free
15,35 Gb Paging File | 13,48 Gb Available in Paging File | 87,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 8,27 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
Drive D: | 160,42 Gb Total Space | 21,06 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 145,83 Gb Free Space | 15,66% Space Free | Partition Type: NTFS
 
Computer Name: DHV | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.10 17:47:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Users\***\Desktop\Virenbekämpfung\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.05 12:59:08 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () -- D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe
PRC - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Care\VCService.exe
PRC - [2011.01.29 06:36:18 | 000,081,016 | ---- | M] (Sony of America Corporation) -- C:\Programme\Sony\VAIO Care\listener.exe
PRC - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe
PRC - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe
PRC - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2010.05.31 19:18:32 | 000,120,176 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2010.05.31 17:01:52 | 000,673,136 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2010.05.18 19:36:48 | 000,253,440 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
PRC - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.27 19:47:49 | 000,116,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\99c56363536370a61cd6b0f8d5baea26\Vodafone.Common.ni.dll
MOD - [2013.05.27 19:47:48 | 001,345,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7879b99363bee1769d83b353d94bedb2\Vodafone.Platform.ni.dll
MOD - [2013.05.27 17:35:32 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.27 17:35:15 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.27 17:35:12 | 000,687,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.27 17:35:11 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.14 11:42:43 | 000,436,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\8c84a3ba5d605db3c4e5e52a88893775\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.14 11:42:43 | 000,056,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\26c218af2560dc13a28d84017318f089\Vodafone.Vpn.ni.dll
MOD - [2013.02.14 11:42:42 | 000,378,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\821644269832a3d0b21dcd972325aaaf\Vodafone.BusinessLogic.ni.dll
MOD - [2013.02.14 11:42:42 | 000,099,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\7be76e081583a5b6fb7296da24b32cf2\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.14 11:42:42 | 000,036,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\d6f2a8f9313ae78339d610624bf1402f\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.14 11:42:41 | 000,345,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\2e25aa42746fb707fc2e2f99a9c4d1ab\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.14 11:42:41 | 000,117,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\25f20a585dd0b062705779e6f4885fa0\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.14 11:42:40 | 001,081,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\ce57c4309968970ced3fefbb73656cb7\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.14 11:42:39 | 000,071,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\e143c73d632ec867c55a7de9b301d992\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.14 11:42:39 | 000,045,568 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\aac12649bd7969eb5f937d14a103f747\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.14 11:42:38 | 001,688,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\baa9058fdc93232aa3e04066db2abb68\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.14 11:42:37 | 000,375,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\9f044c983deddabc805951a779842a84\Vodafone.Data.ni.dll
MOD - [2013.02.14 11:42:37 | 000,259,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\389fbe9d5c33933fd3957da5c4f941cd\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.14 11:42:36 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\0c39a05255ce3e02d613264d3461e3d6\MobileBroadband.ni.exe
MOD - [2013.02.13 18:01:39 | 010,580,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\31a8f96f8939ac18a867ee26cc37eda8\System.Design.ni.dll
MOD - [2013.02.13 18:01:39 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.02.13 18:01:34 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll
MOD - [2013.01.22 19:04:49 | 000,182,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\4f9991daf878fa42d7e05a735998a63d\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.22 19:04:49 | 000,062,464 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Shor#\846c397f7a3a4cdea8a7b38161cd1ae8\Vodafone.Model.Shortcut.ni.dll
MOD - [2013.01.22 19:04:48 | 000,025,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.FortinetCo#\b25d6a4531a691a0635a2ce88871f7c9\Vodafone.FortinetConnector.ni.dll
MOD - [2013.01.22 19:04:47 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceMana#\145afb32e5c6cf0494c1c8ad7faa6786\Vodafone.DeviceManagement.ni.dll
MOD - [2013.01.22 19:04:47 | 000,211,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\09666354085eccf4cb1af14d7df1b94d\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.22 19:04:46 | 002,104,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\4a69d3bfa1111bcd9328e15165ee78ad\Spring.Core.ni.dll
MOD - [2013.01.22 19:04:46 | 000,047,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\0c5008375abad2d7074f91953acd7158\Common.Logging.ni.dll
MOD - [2013.01.22 19:04:45 | 000,029,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\d18ce47ec92816b8b5248a5365305627\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.22 19:04:44 | 000,333,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\93bfa803b521fb7578915cb74920e2f1\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.22 19:04:44 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\7f77988c5a28f2dc6424e6061bd244ef\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.22 19:04:44 | 000,033,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\e3761a4a1ca386d1ec46ccedf2513c80\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,731,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\6e33bdf82851fde9fd4c5288b7d9023f\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.22 19:04:42 | 000,192,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\9dddcd332cca5048f6896785f54d39e4\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,119,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\1ec478df5eaa32e5063377fc796b67b7\Interop.Shell32.ni.dll
MOD - [2013.01.22 19:04:42 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\9309da6c8e71dc1da69339211ebc428e\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.22 19:04:42 | 000,030,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\bd2a39db655db5318e68de06b81be584\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.22 19:04:41 | 000,035,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\60de5d15add08234a0c9cb06c0a8a34c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.22 19:04:41 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\4de5d56d8d91b0535cc058638ea19ae1\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.22 19:04:39 | 000,080,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\4289ee6b9a747e7bc76770e9fb33b0dc\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.22 19:04:39 | 000,060,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Conflictin#\03658a6bc4484a2b177f41aee5d0ab77\Vodafone.ConflictingApplications.ni.dll
MOD - [2013.01.22 19:04:39 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\61a307d8230bcbc357d2745bb2b524d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.22 19:04:38 | 000,932,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\908f155f653d51d69ebbd70b6eec54be\MobileBroadbandResources.ni.dll
MOD - [2013.01.22 19:04:38 | 000,300,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Win32\b44362b8d32cba31e81cd89dfc58912e\Vodafone.Win32.ni.dll
MOD - [2013.01.22 19:04:38 | 000,067,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\5b4d17c27ee2c3a3c0b1125e7bc50228\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.22 19:04:36 | 000,074,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\da96079fbd846fbf4245080777e4147b\Vodafone.LogEngine.ni.dll
MOD - [2013.01.22 19:04:34 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll
MOD - [2013.01.22 19:04:33 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\f7cb3ae5de64f8cbde3ccc57c780743a\IAStorUtil.ni.dll
MOD - [2013.01.22 11:53:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.22 11:53:07 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\81edf0da5f951bd97acfbb9d54504617\System.Data.ni.dll
MOD - [2013.01.22 11:53:07 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll
MOD - [2013.01.22 11:52:46 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.22 11:52:45 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.22 11:52:34 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.22 11:52:29 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.22 11:52:24 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.07.26 02:20:33 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.01.29 06:36:18 | 000,259,192 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.04.21 11:11:00 | 000,477,104 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysNative\GNabcoms.exe -- (gnab_device)
SRV - [2013.05.24 16:16:52 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.05.08 00:37:15 | 000,143,088 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 10:44:28 | 001,286,784 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Update\VUAgent.exe -- (VUAgent)
SRV - [2012.10.22 23:23:36 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () [Auto | Running] -- D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe -- (StumbleUponUpdater)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.07.27 18:43:55 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.27 17:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 17:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Care\VCService.exe -- (VCService)
SRV - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe -- (BackupService)
SRV - [2010.06.21 18:00:52 | 000,575,856 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2010.06.08 23:55:14 | 000,952,096 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.06.08 17:00:04 | 000,836,608 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) [Auto | Running] -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe -- (QDLService2kSony)
SRV - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.03.05 10:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2010.03.05 10:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe -- (iPAHelper.exe)
SRV - [2007.04.21 11:10:56 | 000,508,848 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GNabcoms.exe -- (gnab_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.02.18 10:22:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.12.06 13:11:40 | 011,518,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Netwsw00.sys -- (NETwNs64)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.02 08:30:46 | 000,042,776 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.07.27 23:51:36 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2011.04.27 15:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.12 22:14:50 | 000,078,848 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe)
DRV:64bit: - [2010.06.18 22:12:58 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.06.18 22:11:36 | 000,094,208 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
DRV:64bit: - [2010.06.18 22:10:26 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.06.18 22:10:24 | 000,342,056 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.06.18 22:10:24 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.06.18 22:10:24 | 000,102,952 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.06.18 22:09:47 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.06.03 11:17:50 | 000,442,368 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbnetsny2k.sys -- (qcusbnetsny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,230,784 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbserSny2k.sys -- (qcusbserSny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,137,800 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcombussny.sys -- (qcombussny)
DRV:64bit: - [2010.06.03 11:17:48 | 000,006,400 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcfiltersny2k.sys -- (qcfiltersny2k)
DRV:64bit: - [2010.05.31 12:05:06 | 007,689,216 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.04.26 22:20:29 | 000,012,032 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2010.03.08 22:10:27 | 000,294,064 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.01 10:35:21 | 000,299,568 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV - [2011.09.22 08:45:28 | 000,030,080 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS -- (HWiNFO32)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{1D11CF59-DCAA-4025-AA9F-6688C2B243BE}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{47AEF237-4274-4F0E-A5F6-3DBB8EA3EB13}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363
IE - HKCU\..\SearchScopes\{6983E10E-1B3F-49AB-B882-8CDFE6CBD55B}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Ba3a5c777-f583-4fef-9380-ab4add1bc2a8%7D:5.0
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.07.26 02:45:44 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.02.16 00:11:04 | 000,000,000 | ---D | M] (StumbleUpon) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\toolbar@stumbleupon.com
[2013.05.25 14:04:26 | 000,534,261 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.01.20 01:05:47 | 000,013,972 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi
[2013.05.24 16:16:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Google-Suche = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: StumbleUpon = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg\3.97.1_0\
CHR - Extension: Google Mail = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (StumbleUpon) - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite\launcher.exe (UPEK Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 77.109.128.2 213.144.129.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA23525E-17A8-418F-B10A-CFA1E8DC9CE0}: DhcpNameServer = 77.109.128.2 213.144.129.20
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MIF5BA~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\Protector Suite\psqlpwd.dll) - C:\Programme\Protector Suite\psqlpwd.dll (UPEK Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.09.15 06:12:14 | 000,000,080 | -H-- | M] () - E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.10 17:46:55 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Virenbekämpfung
[2013.06.10 04:19:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.06.10 04:07:36 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\SUPERAntiSpyware.com
[2013.06.10 04:07:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013.06.10 04:02:19 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\Malwarebytes
[2013.06.10 04:00:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.06.10 04:00:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.06.10 04:00:13 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.06.10 04:00:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.06.10 04:00:03 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Local\Programs
[2013.06.08 23:33:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.06.03 18:29:05 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Viktor neu
[2013.06.01 22:43:23 | 000,000,000 | ---D | C] -- D:\Users\***\Documents\2013
[2013.05.31 23:57:38 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Booz Workshop
[2013.05.31 14:48:25 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Arbeitszeiten
[2013.05.27 01:36:41 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Finance and Economic
[2013.05.25 22:20:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.05.25 22:20:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.05.24 16:15:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.05.16 01:18:17 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\dvdcss
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.10 18:01:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.10 17:37:28 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 17:37:28 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 17:34:35 | 001,619,868 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.10 17:34:35 | 000,699,182 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.10 17:34:35 | 000,654,460 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.10 17:34:35 | 000,149,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.10 17:34:35 | 000,122,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.10 17:30:40 | 000,000,558 | ---- | M] () -- C:\Windows\tasks\MATLAB R2012a Startup Accelerator.job
[2013.06.10 17:30:35 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.10 17:30:19 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.06.10 17:30:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.10 17:30:07 | 1887,821,823 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.10 16:28:22 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 12:07:00 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | M] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | M] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | M] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:58 | 000,379,874 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:49 | 000,227,360 | ---- | M] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:37 | 000,650,499 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | M] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | M] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | M] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | M] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | M] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:38 | 001,030,686 | ---- | M] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | M] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | M] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:05 | 000,206,412 | ---- | M] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:05 | 001,077,494 | ---- | M] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.31 15:35:05 | 000,264,500 | ---- | M] () -- C:\test.xml
[2013.05.30 18:58:24 | 000,000,997 | ---- | M] () -- D:\Users\***\Desktop\Dropbox.lnk
[2013.05.27 19:54:22 | 002,341,520 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.26 19:26:19 | 000,044,691 | ---- | M] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:07:06 | 018,041,144 | ---- | M] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:25 | 000,364,129 | ---- | M] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:19 | 000,097,596 | ---- | M] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | M] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:39:41 | 001,717,020 | ---- | M] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:03 | 001,294,290 | ---- | M] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | M] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:33 | 000,637,711 | ---- | M] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | C] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | C] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | C] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:57 | 000,379,874 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:47 | 000,227,360 | ---- | C] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:35 | 000,650,499 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | C] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | C] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | C] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | C] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | C] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:37 | 001,030,686 | ---- | C] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | C] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | C] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:04 | 000,206,412 | ---- | C] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:04 | 001,077,494 | ---- | C] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.27 01:50:03 | 001,555,176 | ---- | C] () -- D:\Users\***\Desktop\Spreadsheet Modeling in Corp Finance for Brealey Myers.pdf
[2013.05.27 01:44:38 | 001,989,035 | ---- | C] () -- D:\Users\***\Desktop\The Dark Side of Valuation - Damodaran.pdf
[2013.05.27 01:42:40 | 001,952,974 | ---- | C] () -- D:\Users\***\Desktop\K. Sydsaeter, A. Strøm - Economists’ Mathematical Manual.pdf
[2013.05.27 01:42:15 | 026,006,434 | ---- | C] () -- D:\Users\***\Desktop\Alpha C. Chiang - Fundamental Methods of Mathematical Economics.pdf
[2013.05.26 19:26:19 | 000,044,691 | ---- | C] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:06:57 | 018,041,144 | ---- | C] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:24 | 000,364,129 | ---- | C] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:18 | 000,097,596 | ---- | C] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | C] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:38:55 | 001,717,020 | ---- | C] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:02 | 001,294,290 | ---- | C] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | C] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:30 | 000,637,711 | ---- | C] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[2013.04.25 11:52:10 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\zlib.dll
[2013.04.25 11:52:04 | 001,208,320 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabserv.dll
[2013.04.25 11:52:03 | 000,614,400 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomc.dll
[2013.04.25 11:52:03 | 000,508,848 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcoms.exe
[2013.04.25 11:52:03 | 000,507,904 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabhcp.dll
[2013.04.25 11:52:03 | 000,425,984 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomm.dll
[2013.04.25 11:52:03 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabprox.dll
[2013.02.11 17:32:00 | 000,000,045 | RH-- | C] () -- C:\Windows\sgc_user.dat
[2013.01.01 15:02:01 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2012.11.04 20:33:45 | 000,000,218 | ---- | C] () -- D:\Users\***\.recently-used.xbel
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2012.03.26 17:13:42 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2012.03.26 17:13:42 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.10.30 19:35:04 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.10.30 19:31:18 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.08.04 03:35:25 | 000,007,597 | ---- | C] () -- D:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccessv4_OwnerName
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- C:\ProgramData\iPodAccessv4_OwnerName
[2011.07.31 18:37:19 | 000,000,269 | ---- | C] () -- D:\Users\***\AppData\Roaming\iPod Access v4 Prefs
[2011.07.31 18:34:21 | 000,000,011 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccess_Time
[2011.07.27 15:59:43 | 001,599,308 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.05.17 14:20:06 | 000,157,382 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012.08.21 15:11:31 | 000,857,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012.08.21 15:37:44 | 000,636,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012.08.21 15:08:38 | 000,453,120 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.07.28 14:34:42 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\AusLogics
[2013.02.14 16:10:46 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\benibela
[2012.06.08 16:49:27 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Bizagi Ltd
[2011.07.27 23:57:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2013.06.10 17:11:37 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Dropbox
[2012.01.09 20:08:59 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\foobar2000
[2012.12.17 15:21:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\FreeFLVConverter
[2012.11.04 20:13:31 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gretl
[2012.11.04 20:33:25 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gtk-2.0
[2012.06.08 16:49:28 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\IsolatedStorage
[2012.01.28 22:14:40 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Leadertech
[2013.01.01 15:06:26 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\MySQL
[2013.01.01 19:44:10 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Oracle
[2011.07.26 02:45:15 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Protector Suite
[2013.02.11 17:32:01 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Quantitative Micro Software
[2012.10.12 13:18:57 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\RStudio
[2011.07.26 02:45:16 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Vodafone
[2012.09.28 01:04:48 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\WindSolutions
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---

Extras von OTL
OTL Logfile:

OTL Extras logfile created on: 10.06.2013 18:00:32 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Users\***\Desktop\Virenbekämpfung
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 5,94 Gb Available Physical Memory | 77,40% Memory free
15,35 Gb Paging File | 13,48 Gb Available in Paging File | 87,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 8,27 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
Drive D: | 160,42 Gb Total Space | 21,06 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 145,83 Gb Free Space | 15,66% Space Free | Partition Type: NTFS
 
Computer Name: DHV | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.txt [@ = txtfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Value error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MIF5BA~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Value error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MIF5BA~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E31CDE7-6213-4C88-BCF4-4A83EC3A4565}" = lport=445 | protocol=6 | dir=in | app=system | 
"{20A55E47-BE57-4C6F-B940-589625E49E01}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2633206C-8F1C-4545-96A1-4129723C2A79}" = lport=139 | protocol=6 | dir=in | app=system | 
"{314D390C-0395-43C5-99C8-354F2F7AE182}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{423D4CC6-0E7A-43EF-B795-3AC1AACF7777}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{652AF02F-A933-407C-800A-ADFAE27C2AFC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{6BD97993-F52D-435F-8DA0-BBC797267A43}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{8E9AD4F9-30E3-4603-B40D-71763B3B7A71}" = rport=138 | protocol=17 | dir=out | app=system | 
"{94074545-A124-4BB6-8D11-EE7F1C6148A4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{AB4C409B-F707-4D8A-BB10-54595E38A0B8}" = rport=137 | protocol=17 | dir=out | app=system | 
"{B7F759B1-7BC5-477D-9B02-4ACCC85C616D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D09E7696-DC01-4F01-B855-B25D9F39CB35}" = rport=139 | protocol=6 | dir=out | app=system | 
"{D258A55F-015E-4565-BF6C-461C051BA2F2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{E30B5706-06E5-4BC1-B507-8837CF0D7E31}" = lport=137 | protocol=17 | dir=in | app=system | 
"{EB89F02A-A12A-4B93-877D-374E6180DB46}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02DE9030-52B8-4E10-B527-F96FCB879BEA}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{05C65677-16D2-4AD2-AA3F-C8743EC0BEC9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{09C98114-720E-41DD-ACFA-D2D812547B7D}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\devicesetup.exe | 
"{13F022BD-529E-44E8-9126-CB01E1472616}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{186D48EA-EBCB-46C9-9246-FEE654EE883F}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe | 
"{1ED7E116-2DD4-442C-A6E9-1F102D1D154F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{28C58EF1-2547-4436-A650-68FFED1D8AB3}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | 
"{2FF46896-662F-4E76-9840-F85ACAEC92D3}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{40C865DE-DBF9-41A3-91F1-5B6D49A770FB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{41FFAD23-B932-46F1-B8C1-47B8B58C4DBC}" = protocol=17 | dir=in | app=c:\windows\system32\gnabcoms.exe | 
"{461BBBE0-C4AD-4A87-ADB8-28AADC481ADD}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe | 
"{4BBFC7D5-0B20-487B-B58D-58472D06A01E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{4F916CB9-CC5D-4EB1-BB4E-76DF43F94F4D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{4FDC1387-36F4-4690-994C-A30A6383DA52}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{5452CFEE-2D30-469A-93BF-8DEBB6567B0C}" = protocol=6 | dir=in | app=d:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{75DD64DF-FC63-41D5-BA00-F2C2804646BA}" = protocol=17 | dir=in | app=c:\windows\system32\gnabcoms.exe | 
"{7AB3540C-44BC-49B1-AE2A-9B0FF2902279}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{8E76A8C8-271C-446C-AA70-0E4A684DA5EB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{8F66C473-157E-409F-82DA-0EA099C226FD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{99E1E66F-6B6E-4635-9A0D-F31CDF1B47CC}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe | 
"{9D3F9C5A-D7D6-4AFD-99E5-C03A1BD90F5D}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe | 
"{A055F2F9-6500-4A14-9537-ADEB50A9AE4A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A2ADB9EC-A1CE-48D0-83F5-3FD7E15F0892}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{A7BBBE13-9647-4A1D-BB02-6C56D87F277D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{AFD68EA8-DAC1-41B7-A00B-AA1863AF711A}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe | 
"{B36E90A5-6FDE-4C1B-AB81-C49173F747DF}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe | 
"{B5EB82F4-90EF-4C3C-9E4B-DE9A921BECBF}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\devicesetup.exe | 
"{B73202EE-187C-489E-949E-1E0BBD5B0D21}" = protocol=6 | dir=in | app=c:\windows\system32\gnabcoms.exe | 
"{B94AA242-F301-40E4-94B3-CA5F598DC9AF}" = protocol=6 | dir=in | app=c:\windows\system32\gnabcoms.exe | 
"{C206A8A5-3116-428A-AEE1-B16D8270B6E9}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{C391E1AE-5D1E-4A8D-B32C-D6CEC29AD93E}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{C4AC250B-3ABD-499A-AE65-E8BDDC0D6FC1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{C52A19BB-9CF8-4A8E-BF38-E53B127F8C81}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{D171CB29-D094-4AB5-A5A0-16B97A97B5E7}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe | 
"{D616A4F1-FC47-4D07-B1F0-3C06B79EC00E}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe | 
"{D714052C-90BF-451B-AE81-9FD4D2139C70}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{DA4D3C0C-9BC4-4568-A706-AC29DD65F7B3}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe | 
"{DC2C2CDA-4BD3-4CEC-A008-A76C43FFC00B}" = protocol=17 | dir=in | app=d:\users\***\appdata\roaming\dropbox\bin\dropbox.exe | 
"{EF09818A-AD31-4FE9-936E-B0DC4F86D9AA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{EF45EC90-77AD-4AE8-847D-91945335FF84}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe | 
"{F08F0744-B981-4004-BF9E-8E269F238370}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{F0B50485-4D84-4624-AEB3-091614F55290}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{FAB3FE90-8C97-4781-B22E-6226AD56E68E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{FC6C426D-0C52-43AB-BAF2-333FE51D4385}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe | 
"{FF27D569-A7F1-448D-AD73-5726972257DF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"TCP Query User{057B8122-8832-4A8D-951C-902CCEFF2B3A}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"TCP Query User{1FE1A380-E5D7-4B13-90E6-F7DAADF7B848}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{3FD506FE-B6DC-42BF-A6E4-B663DAAEF414}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{70FFBB5D-3AAA-46DC-B67F-F99B6430842D}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{8B44EE64-4058-4330-A402-041AB75E84BB}C:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe | 
"TCP Query User{99C1D233-CDFF-403C-8DDB-DFCE29BCDB24}C:\windows\syswow64\java.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\java.exe | 
"TCP Query User{9C1E601E-C37E-41A4-920E-50800E177CED}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 
"TCP Query User{A6AAECF4-B768-4D9F-ACAE-5E873FC23A67}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe | 
"TCP Query User{BDAE7BB0-A3E6-4D86-B53A-78EA4EF8C1DF}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{CCEF827A-F2A6-40A0-9B29-AF305AE0687E}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{CF3B0393-F4C7-4BFD-B1A0-2336ABB70C82}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{08662A52-4AAF-46CA-A331-13E800D84224}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe | 
"UDP Query User{148E2767-DBA9-4239-9B65-51D23914A3DA}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{4C083E6E-CF12-4C88-8058-5ED789CC8FAF}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{630B8240-43AF-49CB-8449-E95F8559CA44}C:\windows\syswow64\java.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\java.exe | 
"UDP Query User{76EA529A-180B-4676-8B7C-41E84E667E74}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{8F8EB7FD-C7C9-4A32-8724-1843252CC7C8}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{A0BAEA2D-0EF8-4422-A5F6-2C9D5C999276}C:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe | 
"UDP Query User{AA7790E4-A465-4B4E-A363-AE000F76930E}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"UDP Query User{ADB54784-74E8-44D1-BEB2-C97CC2ADEA75}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{E65FCDAD-47B3-4AB0-86C0-7E4E9B14FDF5}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{F838F5A2-D21E-4D56-A6ED-84D2C33B633F}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F841121-4DB6-4B31-839F-7F5AB3BB3423}" = Protector Suite 2009
"{1111706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 (64-bit)
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{2222706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 SDK (64-bit)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{467D5E81-8349-4892-9E81-C3674ED8E451}" = Cisco Systems VPN Client 5.0.07.0290
"{64A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java(TM) SE Development Kit 7 Update 3 (64-bit)
"{68570626-1BF6-310B-AF69-6CD686C04AEA}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{6B7DE186-374B-4873-AEC1-7464DA337DD6}" = VU5x64
"{6C8D7973-31F9-32E1-A820-8DD857910323}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{704C0303-D20C-45AF-BD2B-556EAF31BE09}" = iCloud
"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{84452C2C-BDCC-36F3-A189-CE15F02A47FB}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{84E30D73-E30F-3A02-BAA0-5353C04DD18A}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951E6223-AC28-345E-BCF4-B55C1267E321}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{9ED333F8-3E6C-4A38-BAFA-728454121CDA}" = PDF-XChange Viewer
"{A0B0F02C-410B-3DE3-9740-EC4C3D902532}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{C41713B3-DCB0-48C3-B830-47CB59C60B89}" = HP Officejet 6500 E710n-z - Grundlegende Software für das Gerät
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D16A2127-B927-4379-B153-3DEC091E4EEB}" = Intel(R) PROSet/Wireless WiFi-Software
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FD868C71-6CCF-42E2-B90D-0504AB0036FE}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"Matlab R2012a" = MATLAB R2012a
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"NVIDIA Drivers" = NVIDIA Drivers
"OEM_HostCD" = Printer Software Uninstall
"ProInst" = Intel PROSet Wireless
"R for Windows 2.14.0_is1" = R for Windows 2.14.0
"Registry Toolkit (x64 Shareware)_is1" = Registry Toolkit (x64)
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"sp6" = Logitech SetPoint 6.32
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00B03993-F5A1-47B1-9C54-EC8FBDDDE17E}" = VAIO Care
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1F4E59C0-EE31-47EE-BCC3-1A73C3F023BF}" = Qualcomm Gobi 2000 Package for Sony
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-In für Microsoft Office
"{2F9D63BE-A891-4E39-AFB3-7402D486800C}" = VAIO Hardware Diagnostics
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO-Support für Übertragungen
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband
"{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}" = 
"{70991E0A-1108-437E-BA7D-085702C670C0}" = 
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{803E4FA5-A940-4420-B89D-A8BC2E160247}" = 
"{8211C280-5B02-4E7E-B55F-845A207249BA}" = VAIO Data Restore Tool
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" = 
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" = 
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5B016F-D452-4650-92D4-219567EA257A}" = Bizagi Process Modeler
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = 
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B68FC32E-D58F-4B74-A838-B265BF40A445}" = EViews 7
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO-Handbuch
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" = 
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2D23D08-D10E-43D6-883C-78E0B2AC9CC6}" = VU5x86
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}" = ArcSoft WebCam Companion 3
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{EFBC0CB1-AFFD-4E74-ACEF-42099F1D49C3}" = HP Officejet 6500 E710n-z Hilfe
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FB0C267C-8B4F-4867-8161-A6A3B66D42C1}" = Marketsplash Schnellzugriffe
"{FB77DB0C-6951-47B6-9D80-A0FDBEE0334C}" = 
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"foobar2000" = foobar2000 v1.1.8
"Google Chrome" = Google Chrome
"HWiNFO32_is1" = HWiNFO32 Version 3.90
"InstallShield_{8A5B016F-D452-4650-92D4-219567EA257A}" = Bizagi Process Modeler
"iPod Access for Windows_is1" = iPod Access for Windows v4.4.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"RStudio" = RStudio
"TexMakerX_is1" = TexMakerX 2.1
"VAIO Help and Support" = 
"VAIO screensaver" = VAIO screensaver
"Veetle TV" = Veetle TV
"VLC media player" = VLC media player 1.1.5
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
Error encountered while reading event logs.
 
< End of report >
         

--- --- ---


Gmer
[Code]

GMER Logfile:

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-10 18:26:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 238,50GB
Running: gmer_2.1.19163.exe; Driver: D:\Users\DINHHU~1\AppData\Local\Temp\pxldapow.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\Windows\system32\drivers\USBPORT.SYS!DllUnload                                                                                                 fffff88005a28d64 12 bytes {MOV RAX, 0xfffffa80099522a0; JMP RAX}

---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           0000000075991465 2 bytes [99, 75]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000759914bb 2 bytes [99, 75]
.text   ...                                                                                                                                               * 2
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000075991465 2 bytes [99, 75]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       00000000759914bb 2 bytes [99, 75]
.text   ...                                                                                                                                               * 2
.text   C:\Windows\SysWOW64\RunDll32.exe[5052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                    0000000075991465 2 bytes [99, 75]
.text   C:\Windows\SysWOW64\RunDll32.exe[5052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                   00000000759914bb 2 bytes [99, 75]
.text   ...                                                                                                                                               * 2
.text   C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075991465 2 bytes [99, 75]
.text   C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000759914bb 2 bytes [99, 75]
.text   ...                                                                                                                                               * 2

---- Devices - GMER 2.1 ----

Device  \FileSystem\Ntfs \Ntfs                                                                                                                            fffffa800723b2c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{CE145043-03E3-435E-A1F5-C59B2B060D88}                                                                          fffffa8009a982c0
Device  \Driver\usbehci \Device\USBPDO-1                                                                                                                  fffffa8009e7d2c0
Device  \Driver\cdrom \Device\CdRom0                                                                                                                      fffffa8009a2c2c0
Device  \Driver\usbehci \Device\USBFDO-0                                                                                                                  fffffa8009e7d2c0
Device  \Driver\usbehci \Device\USBFDO-1                                                                                                                  fffffa8009e7d2c0
Device  \Driver\volmgr \Device\HarddiskVolume1                                                                                                            fffffa80072332c0
Device  \Driver\volmgr \Device\FtControl                                                                                                                  fffffa80072332c0
Device  \Driver\volmgr \Device\VolMgrControl                                                                                                              fffffa80072332c0
Device  \Driver\volmgr \Device\HarddiskVolume2                                                                                                            fffffa80072332c0
Device  \Driver\volmgr \Device\HarddiskVolume3                                                                                                            fffffa80072332c0
Device  \Driver\volmgr \Device\HarddiskVolume4                                                                                                            fffffa80072332c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{BA23525E-17A8-418F-B10A-CFA1E8DC9CE0}                                                                          fffffa8009a982c0
Device  \Driver\NetBT \Device\NetBt_Wins_Export                                                                                                           fffffa8009a982c0
Device  \Driver\usbehci \Device\USBPDO-0                                                                                                                  fffffa8009e7d2c0

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313dbb8cf                                                                       
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38ef8cf0                                                                       
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                                                771343423
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                                                285507792
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                                                1
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                  
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                               0x00 0x00 0x00 0x00 ...
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                               0
Reg     HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                            0x11 0xFF 0xEC 0x54 ...
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313dbb8cf (not active ControlSet)                                                   
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38ef8cf0 (not active ControlSet)                                                   
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                              
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                   0x00 0x00 0x00 0x00 ...
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                   0
Reg     HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                0x11 0xFF 0xEC 0x54 ...

---- EOF - GMER 2.1 ----
         

--- --- ---


Seit dem Absturz sehe ich eine desktop.ini auf meinem Desktop.

Daemon Tools habe ich vor der Anwendung deinstalliert.
Veoh Webplayer (wo der Virus war) habe ich auch deinstalliert, den Ordner gibt’s aber immer noch in C:
Kleine Anmerkung: meine Bibliotheken sind auf D: und nicht auf der Systemplatte, ausserdem benutze ich NoScript.
Ich bedanke mich für die Hilfe, dass der PC jetzt nicht funktioniert ist sehr ungünstig, da ich in der Prüfungsphase bin und auf den PC angewiesen bin.

lG Ray

Hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo schrauber,

vielen Dank für die schnelle Rückmeldung, nachfolgend das logfile von Combofix.

ComboFix 13-06-08.02 - *** 10.06.2013  19:19:44.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.7862.5858 [GMT 2:00]
ausgeführt von:: d:\users\***\Desktop\Virenbekõmpfung\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe
d:\users\***\AppData\Local\assembly\tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-10 bis 2013-06-10  ))))))))))))))))))))))))))))))
.
.
2013-06-10 17:28 . 2013-06-10 17:28	--------	d-----w-	d:\users\Default\AppData\Local\temp
2013-06-10 17:28 . 2013-06-10 17:28	--------	d-----w-	d:\users\Administrator\AppData\Local\temp
2013-06-10 15:47 . 2013-06-10 15:47	76232	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FCFFDE03-2D1D-48D8-B452-C5894DD7F594}\offreg.dll
2013-06-10 15:41 . 2013-05-13 06:37	9460464	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FCFFDE03-2D1D-48D8-B452-C5894DD7F594}\mpengine.dll
2013-06-10 02:19 . 2013-06-10 02:19	--------	d-----w-	c:\program files (x86)\ESET
2013-06-10 02:07 . 2013-06-10 02:07	--------	d-----w-	d:\users\***\AppData\Roaming\SUPERAntiSpyware.com
2013-06-10 02:07 . 2013-06-10 02:07	--------	d-----w-	c:\program files\SUPERAntiSpyware
2013-06-10 02:07 . 2013-06-10 02:07	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2013-06-10 02:02 . 2013-06-10 02:02	--------	d-----w-	d:\users\***\AppData\Roaming\Malwarebytes
2013-06-10 02:00 . 2013-06-10 02:00	--------	d-----w-	c:\programdata\Malwarebytes
2013-06-10 02:00 . 2013-06-10 02:00	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-06-10 02:00 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-06-10 02:00 . 2013-06-10 02:00	--------	d-----w-	d:\users\***\AppData\Local\Programs
2013-06-08 21:33 . 2013-06-08 21:33	--------	d-----w-	c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-08 21:33 . 2013-06-08 21:33	--------	d-----w-	c:\program files\iTunes
2013-06-08 21:33 . 2013-06-08 21:33	--------	d-----w-	c:\program files (x86)\iTunes
2013-06-08 21:33 . 2013-06-08 21:33	--------	d-----w-	c:\program files\iPod
2013-06-07 15:24 . 2013-04-26 07:53	591648	----a-w-	c:\windows\system32\Spool\prtprocs\x64\hpcpp145.dll
2013-06-07 15:24 . 2013-04-26 07:55	518432	----a-w-	c:\windows\SysWow64\hpcdmc32.DLL
2013-06-07 15:24 . 2013-04-26 07:53	438560	----a-w-	c:\windows\system32\hpcpn145.dll
2013-05-25 20:20 . 2013-05-25 20:20	159744	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-05-25 20:20 . 2013-05-25 20:20	159744	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-05-25 20:20 . 2013-05-25 20:20	159744	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-05-25 20:20 . 2013-05-25 20:20	159744	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-05-25 20:20 . 2013-05-25 20:20	159744	----a-w-	c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-05-25 20:20 . 2013-05-25 20:20	--------	d-----w-	c:\program files (x86)\QuickTime
2013-05-21 11:07 . 2009-07-14 01:41	101376	----a-w-	c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2013-05-15 23:18 . 2013-05-15 23:18	--------	d-----w-	d:\users\***\AppData\Roaming\dvdcss
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-27 15:38 . 2011-07-27 14:16	75016696	----a-w-	c:\windows\system32\MRT.exe
2013-05-14 15:52 . 2012-04-02 11:50	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-14 15:52 . 2011-08-08 23:37	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-13 06:37 . 2011-07-28 12:15	9460464	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-02 15:29 . 2011-07-26 12:10	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-05-02 11:30 . 2012-01-28 20:14	18960	----a-w-	c:\windows\system32\drivers\LNonPnP.sys
2013-05-01 01:59 . 2013-05-01 01:59	94208	----a-w-	c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59	69632	----a-w-	c:\windows\SysWow64\QuickTime.qts
2013-04-13 05:49 . 2013-05-27 15:34	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-27 15:34	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-27 15:34	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-27 15:34	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-27 15:34	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-27 15:34	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-27 11:26	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-04-26 16:20	95648	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-22 16:57 . 2012-07-13 22:00	861088	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-03-22 16:57 . 2011-07-25 23:36	782240	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-03-19 06:04 . 2013-04-14 13:42	5550424	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-14 13:42	43520	----a-w-	c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-14 13:42	3968856	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-14 13:42	3913560	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-14 13:42	6656	----a-w-	c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-14 13:42	112640	----a-w-	c:\windows\system32\smss.exe
2006-05-03 11:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 12:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 14:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 23:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}]
2011-11-22 08:59	269824	----a-w-	d:\users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-04-05 59720]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-05-15 5622512]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2010-05-31 673136]
"MobileBroadband"="c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe" [2010-05-18 253440]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-8 1128224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\Protector Suite\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 BackupService;BackupService;d:\users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe;d:\users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 StumbleUponUpdater;StumbleUpon Updater;d:\users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe;d:\users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 gnab_device;gnab_device;c:\windows\system32\GNabcoms.exe;c:\windows\SYSNATIVE\GNabcoms.exe [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys;c:\windows\SYSNATIVE\DRIVERS\MpNWMon.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x]
R3 qcfiltersny2k;Qualcomm Gobi 2000 USB Composite Device Filter 9225;c:\windows\system32\DRIVERS\qcfiltersny2k.sys;c:\windows\SYSNATIVE\DRIVERS\qcfiltersny2k.sys [x]
R3 qcombussny;Gobi 2000 USB Composite Device Driver(05C6-9225);c:\windows\system32\DRIVERS\qcombussny.sys;c:\windows\SYSNATIVE\DRIVERS\qcombussny.sys [x]
R3 qcusbnetsny2k;Gobi 2000 USB-NDIS miniport(05C6-9225);c:\windows\system32\DRIVERS\qcusbnetsny2k.sys;c:\windows\SYSNATIVE\DRIVERS\qcusbnetsny2k.sys [x]
R3 qcusbserSny2k;Gobi 2000 USB Device for Legacy Serial Communication(05C6-9225);c:\windows\system32\DRIVERS\qcusbserSny2k.sys;c:\windows\SYSNATIVE\DRIVERS\qcusbserSny2k.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 QDLService2kSony;Qualcomm Gobi 2000 Download Service (Sony);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe;c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys;c:\windows\SYSNATIVE\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S2 VmbService;Vodafone-Mobile-Broadband-Dienst;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe;c:\program files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys;c:\windows\SYSNATIVE\drivers\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-06 00:01	1165776	----a-w-	c:\program files (x86)\Google\Chrome\Application\27.0.1453.110\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25 23:34]
.
2013-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25 23:34]
.
2013-06-10 c:\windows\Tasks\MATLAB R2012a Startup Accelerator.job
- c:\program files\MATLAB\R2012a\bin\win64\MATLABStartupAccelerator.exe [2012-03-26 01:29]
.
2013-06-10 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2013-05-07 22:37]
.
2013-06-10 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2013-05-07 22:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	164016	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	164016	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	164016	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	164016	----a-w-	d:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2010-04-27 13:48	5947656	----a-w-	c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2010-04-27 13:48	5947656	----a-w-	c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-22 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-22 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-22 410136]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-04 16414824]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-18 9962016]
"PSQLLauncher"="c:\program files\Protector Suite\launcher.exe" [2010-04-27 84744]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 77.109.128.2 213.144.129.20
FF - ProfilePath - d:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3928360360-3382787531-1609204375-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*:¶+<]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3928360360-3382787531-1609204375-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*:¶+<\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-10  19:30:06
ComboFix-quarantined-files.txt  2013-06-10 17:30
.
Vor Suchlauf: 8.555.372.544 Bytes frei
Nach Suchlauf: 8.418.258.944 Bytes frei
.
- - End Of File - - 434AD5B1C822EC8B176670AA597699F1
D41D8CD98F00B204E9800998ECF8427E
         

lG Ray

Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

AdwCleaner

AdwCleaner Logfile:

# AdwCleaner v2.303 - Datei am 10/06/2013 um 19:41:33 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : *** - DHV
# Bootmodus : Normal
# Ausgeführt unter : D:\Users\***\Desktop\Virenbekämpfung\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : StumbleUponUpdater

***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\Babylon
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg
Ordner Gelöscht : D:\Users\***\AppData\LocalLow\StumbleUpon

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\StumbleUpon
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StumbleUpon
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\StumbleUpon.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\StumbleUpon.QTimeCpio.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DB616CFF-D989-48A8-9C85-E2A8D56AB2CA}

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\prefs.js

D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

-\\ Google Chrome v27.0.1453.110

Datei : D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : D:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [2931 octets] - [10/06/2013 19:41:33]

########## EOF - D:\AdwCleaner[S1].txt - [2991 octets] ##########
         

--- --- ---


JRT

JRT Logfile:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by *** on 10.06.2013 at 19:44:14,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: D:\Users\Dinh Huy Vu\AppData\Roaming\mozilla\firefox\profiles\gr7m9czx.default\minidumps [233 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.06.2013 at 19:47:24,74
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

--- --- ---


Gruß, Ray

hallo schrauber,

darf ich fragen, was jetzt genau passiert ist, und was für links dort verschickt worden sind?
Ist das jetzt ein Ausspähprogramm, das meinen Datenverkehr mitloggt?

Danke, lg Ray

Nein, kein Logger. Da wurde einfach dein Account genutzt um Spam zu verschicken. Passwort schon geändert?

Kontrollscans:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches OTL log bitte.

Hi,

ich hab jetzt mehrmals versucht ESET laufen zu lassen, aber der hängt sich nach der Hälfte auf und stürzt dan ab.

SecurityCheck läuft nicht auf dem System. hast du eventl noch eine andere vertrauenswürdige Quelle?

lG, Ray

Ich habe jetzt trotzdem nochmal OTL laufen lassen:

OTL
OTL Logfile:

OTL logfile created on: 10.06.2013 21:43:42 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Users\***\Desktop\Virenbekämpfung
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 4,36 Gb Available Physical Memory | 56,83% Memory free
15,35 Gb Paging File | 12,71 Gb Available in Paging File | 82,81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 14,86 Gb Free Space | 21,24% Space Free | Partition Type: NTFS
Drive D: | 160,42 Gb Total Space | 13,38 Gb Free Space | 8,34% Space Free | Partition Type: NTFS
 
Computer Name: DHV | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.10 17:47:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Users\***\Desktop\Virenbekämpfung\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.05 12:59:08 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Care\VCService.exe
PRC - [2011.01.29 06:36:18 | 000,081,016 | ---- | M] (Sony of America Corporation) -- C:\Programme\Sony\VAIO Care\listener.exe
PRC - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe
PRC - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe
PRC - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2010.05.31 19:18:32 | 000,120,176 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2010.05.31 17:01:52 | 000,673,136 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2010.05.18 19:36:48 | 000,253,440 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
PRC - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.27 19:47:49 | 000,116,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\99c56363536370a61cd6b0f8d5baea26\Vodafone.Common.ni.dll
MOD - [2013.05.27 19:47:48 | 001,345,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7879b99363bee1769d83b353d94bedb2\Vodafone.Platform.ni.dll
MOD - [2013.05.27 17:35:32 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.27 17:35:15 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.27 17:35:12 | 000,687,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.27 17:35:11 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.14 11:42:43 | 000,436,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\8c84a3ba5d605db3c4e5e52a88893775\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.14 11:42:43 | 000,056,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\26c218af2560dc13a28d84017318f089\Vodafone.Vpn.ni.dll
MOD - [2013.02.14 11:42:42 | 000,378,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\821644269832a3d0b21dcd972325aaaf\Vodafone.BusinessLogic.ni.dll
MOD - [2013.02.14 11:42:42 | 000,099,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\7be76e081583a5b6fb7296da24b32cf2\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.14 11:42:42 | 000,036,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\d6f2a8f9313ae78339d610624bf1402f\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.14 11:42:41 | 000,345,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\2e25aa42746fb707fc2e2f99a9c4d1ab\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.14 11:42:41 | 000,117,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\25f20a585dd0b062705779e6f4885fa0\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.14 11:42:40 | 001,081,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\ce57c4309968970ced3fefbb73656cb7\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.14 11:42:39 | 000,071,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\e143c73d632ec867c55a7de9b301d992\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.14 11:42:39 | 000,045,568 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\aac12649bd7969eb5f937d14a103f747\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.14 11:42:38 | 001,688,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\baa9058fdc93232aa3e04066db2abb68\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.14 11:42:37 | 000,375,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\9f044c983deddabc805951a779842a84\Vodafone.Data.ni.dll
MOD - [2013.02.14 11:42:37 | 000,259,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\389fbe9d5c33933fd3957da5c4f941cd\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.14 11:42:36 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\0c39a05255ce3e02d613264d3461e3d6\MobileBroadband.ni.exe
MOD - [2013.02.13 18:01:39 | 010,580,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\31a8f96f8939ac18a867ee26cc37eda8\System.Design.ni.dll
MOD - [2013.02.13 18:01:39 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.01.22 19:04:49 | 000,182,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\4f9991daf878fa42d7e05a735998a63d\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.22 19:04:49 | 000,062,464 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Shor#\846c397f7a3a4cdea8a7b38161cd1ae8\Vodafone.Model.Shortcut.ni.dll
MOD - [2013.01.22 19:04:48 | 000,025,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.FortinetCo#\b25d6a4531a691a0635a2ce88871f7c9\Vodafone.FortinetConnector.ni.dll
MOD - [2013.01.22 19:04:47 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceMana#\145afb32e5c6cf0494c1c8ad7faa6786\Vodafone.DeviceManagement.ni.dll
MOD - [2013.01.22 19:04:47 | 000,211,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\09666354085eccf4cb1af14d7df1b94d\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.22 19:04:46 | 002,104,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\4a69d3bfa1111bcd9328e15165ee78ad\Spring.Core.ni.dll
MOD - [2013.01.22 19:04:46 | 000,047,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\0c5008375abad2d7074f91953acd7158\Common.Logging.ni.dll
MOD - [2013.01.22 19:04:45 | 000,029,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\d18ce47ec92816b8b5248a5365305627\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.22 19:04:44 | 000,333,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\93bfa803b521fb7578915cb74920e2f1\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.22 19:04:44 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\7f77988c5a28f2dc6424e6061bd244ef\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.22 19:04:44 | 000,033,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\e3761a4a1ca386d1ec46ccedf2513c80\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,731,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\6e33bdf82851fde9fd4c5288b7d9023f\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.22 19:04:42 | 000,192,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\9dddcd332cca5048f6896785f54d39e4\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,119,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\1ec478df5eaa32e5063377fc796b67b7\Interop.Shell32.ni.dll
MOD - [2013.01.22 19:04:42 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\9309da6c8e71dc1da69339211ebc428e\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.22 19:04:42 | 000,030,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\bd2a39db655db5318e68de06b81be584\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.22 19:04:41 | 000,035,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\60de5d15add08234a0c9cb06c0a8a34c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.22 19:04:41 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\4de5d56d8d91b0535cc058638ea19ae1\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.22 19:04:39 | 000,080,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\4289ee6b9a747e7bc76770e9fb33b0dc\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.22 19:04:39 | 000,060,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Conflictin#\03658a6bc4484a2b177f41aee5d0ab77\Vodafone.ConflictingApplications.ni.dll
MOD - [2013.01.22 19:04:39 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\61a307d8230bcbc357d2745bb2b524d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.22 19:04:38 | 000,932,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\908f155f653d51d69ebbd70b6eec54be\MobileBroadbandResources.ni.dll
MOD - [2013.01.22 19:04:38 | 000,300,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Win32\b44362b8d32cba31e81cd89dfc58912e\Vodafone.Win32.ni.dll
MOD - [2013.01.22 19:04:38 | 000,067,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\5b4d17c27ee2c3a3c0b1125e7bc50228\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.22 19:04:36 | 000,074,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\da96079fbd846fbf4245080777e4147b\Vodafone.LogEngine.ni.dll
MOD - [2013.01.22 19:04:34 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll
MOD - [2013.01.22 19:04:33 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\f7cb3ae5de64f8cbde3ccc57c780743a\IAStorUtil.ni.dll
MOD - [2013.01.22 11:53:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.22 11:53:07 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\81edf0da5f951bd97acfbb9d54504617\System.Data.ni.dll
MOD - [2013.01.22 11:53:07 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll
MOD - [2013.01.22 11:52:46 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.22 11:52:45 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.22 11:52:34 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.22 11:52:29 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.22 11:52:24 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.07.26 02:20:33 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2011.01.29 06:36:18 | 000,259,192 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.04.21 11:11:00 | 000,477,104 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysNative\GNabcoms.exe -- (gnab_device)
SRV - [2013.05.24 16:16:52 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.05.08 00:37:15 | 000,143,088 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 10:44:28 | 001,286,784 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Update\VUAgent.exe -- (VUAgent)
SRV - [2012.10.22 23:23:36 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.07.27 18:43:55 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.27 17:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 17:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Care\VCService.exe -- (VCService)
SRV - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe -- (BackupService)
SRV - [2010.06.21 18:00:52 | 000,575,856 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2010.06.08 23:55:14 | 000,952,096 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.06.08 17:00:04 | 000,836,608 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) [Auto | Running] -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe -- (QDLService2kSony)
SRV - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.03.05 10:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2010.03.05 10:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe -- (iPAHelper.exe)
SRV - [2007.04.21 11:10:56 | 000,508,848 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GNabcoms.exe -- (gnab_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.02.18 10:22:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.12.06 13:11:40 | 011,518,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Netwsw00.sys -- (NETwNs64)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.02 08:30:46 | 000,042,776 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.07.27 23:51:36 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2011.04.27 15:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.12 22:14:50 | 000,078,848 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe)
DRV:64bit: - [2010.06.18 22:12:58 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.06.18 22:11:36 | 000,094,208 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
DRV:64bit: - [2010.06.18 22:10:26 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.06.18 22:10:24 | 000,342,056 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.06.18 22:10:24 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.06.18 22:10:24 | 000,102,952 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.06.18 22:09:47 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.06.03 11:17:50 | 000,442,368 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbnetsny2k.sys -- (qcusbnetsny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,230,784 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbserSny2k.sys -- (qcusbserSny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,137,800 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcombussny.sys -- (qcombussny)
DRV:64bit: - [2010.06.03 11:17:48 | 000,006,400 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcfiltersny2k.sys -- (qcfiltersny2k)
DRV:64bit: - [2010.05.31 12:05:06 | 007,689,216 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.04.26 22:20:29 | 000,012,032 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2010.03.08 22:10:27 | 000,294,064 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.01 10:35:21 | 000,299,568 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV - [2011.09.22 08:45:28 | 000,030,080 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS -- (HWiNFO32)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{1D11CF59-DCAA-4025-AA9F-6688C2B243BE}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{47AEF237-4274-4F0E-A5F6-3DBB8EA3EB13}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363
IE - HKCU\..\SearchScopes\{6983E10E-1B3F-49AB-B882-8CDFE6CBD55B}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Ba3a5c777-f583-4fef-9380-ab4add1bc2a8%7D:5.0
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.07.26 02:45:44 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.02.16 00:11:04 | 000,000,000 | ---D | M] (StumbleUpon) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\toolbar@stumbleupon.com
[2013.05.25 14:04:26 | 000,534,261 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.01.20 01:05:47 | 000,013,972 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi
[2013.05.24 16:16:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
CHR - Extension: Google-Suche = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Google Mail = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013.06.10 19:28:55 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite\launcher.exe (UPEK Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 77.109.128.2 213.144.129.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA23525E-17A8-418F-B10A-CFA1E8DC9CE0}: DhcpNameServer = 77.109.128.2 213.144.129.20
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MIF5BA~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\Protector Suite\psqlpwd.dll) - C:\Programme\Protector Suite\psqlpwd.dll (UPEK Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.10 19:44:14 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.10 19:44:11 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.10 19:39:43 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.10 19:30:08 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.06.10 19:18:55 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.10 19:18:55 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.10 19:18:55 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.10 19:18:51 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.10 19:18:45 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.10 17:46:55 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Virenbekämpfung
[2013.06.10 04:19:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.06.10 04:07:36 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\SUPERAntiSpyware.com
[2013.06.10 04:07:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013.06.10 04:02:19 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\Malwarebytes
[2013.06.10 04:00:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.06.10 04:00:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.06.10 04:00:13 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.06.10 04:00:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.06.10 04:00:03 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Local\Programs
[2013.06.08 23:33:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.06.03 18:29:05 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Viktor neu
[2013.06.01 22:43:23 | 000,000,000 | ---D | C] -- D:\Users\***\Documents\2013
[2013.05.31 23:57:38 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Booz Workshop
[2013.05.31 14:48:25 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Arbeitszeiten
[2013.05.27 01:36:41 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Finance and Economic
[2013.05.25 22:20:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.05.25 22:20:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.05.24 16:15:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.05.16 01:18:17 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\dvdcss
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.10 21:01:06 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.10 20:07:00 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 19:50:01 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 19:50:01 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 19:47:35 | 001,619,868 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.10 19:47:35 | 000,699,182 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.10 19:47:35 | 000,654,460 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.10 19:47:35 | 000,149,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.10 19:47:35 | 000,122,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.10 19:43:09 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.10 19:43:08 | 000,000,558 | ---- | M] () -- C:\Windows\tasks\MATLAB R2012a Startup Accelerator.job
[2013.06.10 19:42:55 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.06.10 19:42:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.10 19:42:45 | 1887,821,823 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.10 19:38:48 | 000,003,280 | ---- | M] () -- C:\bootsqm.dat
[2013.06.10 19:28:55 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.10 18:36:18 | 570,163,704 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.06.10 16:28:22 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | M] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | M] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | M] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:58 | 000,379,874 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:49 | 000,227,360 | ---- | M] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:37 | 000,650,499 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | M] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | M] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | M] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | M] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | M] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:38 | 001,030,686 | ---- | M] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | M] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | M] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:05 | 000,206,412 | ---- | M] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:05 | 001,077,494 | ---- | M] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.31 15:35:05 | 000,264,500 | ---- | M] () -- C:\test.xml
[2013.05.30 18:58:24 | 000,000,997 | ---- | M] () -- D:\Users\***\Desktop\Dropbox.lnk
[2013.05.27 19:54:22 | 002,341,520 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.26 19:26:19 | 000,044,691 | ---- | M] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:07:06 | 018,041,144 | ---- | M] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:25 | 000,364,129 | ---- | M] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:19 | 000,097,596 | ---- | M] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | M] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:39:41 | 001,717,020 | ---- | M] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:03 | 001,294,290 | ---- | M] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | M] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:33 | 000,637,711 | ---- | M] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.10 19:38:48 | 000,003,280 | ---- | C] () -- C:\bootsqm.dat
[2013.06.10 19:18:55 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.10 19:18:55 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.10 19:18:55 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.10 19:18:55 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.10 19:18:55 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.10 18:36:18 | 570,163,704 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | C] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | C] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | C] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:57 | 000,379,874 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:47 | 000,227,360 | ---- | C] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:35 | 000,650,499 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | C] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | C] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | C] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | C] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | C] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:37 | 001,030,686 | ---- | C] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | C] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | C] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:04 | 000,206,412 | ---- | C] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:04 | 001,077,494 | ---- | C] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.27 01:50:03 | 001,555,176 | ---- | C] () -- D:\Users\***\Desktop\Spreadsheet Modeling in Corp Finance for Brealey Myers.pdf
[2013.05.27 01:44:38 | 001,989,035 | ---- | C] () -- D:\Users\***\Desktop\The Dark Side of Valuation - Damodaran.pdf
[2013.05.27 01:42:40 | 001,952,974 | ---- | C] () -- D:\Users\***\Desktop\K. Sydsaeter, A. Strøm - Economists’ Mathematical Manual.pdf
[2013.05.27 01:42:15 | 026,006,434 | ---- | C] () -- D:\Users\***\Desktop\Alpha C. Chiang - Fundamental Methods of Mathematical Economics.pdf
[2013.05.26 19:26:19 | 000,044,691 | ---- | C] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:06:57 | 018,041,144 | ---- | C] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:24 | 000,364,129 | ---- | C] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:18 | 000,097,596 | ---- | C] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | C] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:38:55 | 001,717,020 | ---- | C] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:02 | 001,294,290 | ---- | C] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | C] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:30 | 000,637,711 | ---- | C] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[2013.04.25 11:52:10 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\zlib.dll
[2013.04.25 11:52:04 | 001,208,320 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabserv.dll
[2013.04.25 11:52:03 | 000,614,400 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomc.dll
[2013.04.25 11:52:03 | 000,508,848 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcoms.exe
[2013.04.25 11:52:03 | 000,507,904 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabhcp.dll
[2013.04.25 11:52:03 | 000,425,984 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomm.dll
[2013.04.25 11:52:03 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabprox.dll
[2013.02.11 17:32:00 | 000,000,045 | RH-- | C] () -- C:\Windows\sgc_user.dat
[2013.01.01 15:02:01 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2012.11.04 20:33:45 | 000,000,218 | ---- | C] () -- D:\Users\***\.recently-used.xbel
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2012.03.26 17:13:42 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2012.03.26 17:13:42 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.10.30 19:35:04 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.10.30 19:31:18 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.08.04 03:35:25 | 000,007,597 | ---- | C] () -- D:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccessv4_OwnerName
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- C:\ProgramData\iPodAccessv4_OwnerName
[2011.07.31 18:37:19 | 000,000,269 | ---- | C] () -- D:\Users\***\AppData\Roaming\iPod Access v4 Prefs
[2011.07.31 18:34:21 | 000,000,011 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccess_Time
[2011.07.27 15:59:43 | 001,599,308 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.05.17 14:20:06 | 000,157,382 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012.08.21 15:11:31 | 000,857,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012.08.21 15:37:44 | 000,636,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012.08.21 15:08:38 | 000,453,120 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.07.28 14:34:42 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\AusLogics
[2013.02.14 16:10:46 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\benibela
[2012.06.08 16:49:27 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Bizagi Ltd
[2011.07.27 23:57:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2013.06.10 17:11:37 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Dropbox
[2012.01.09 20:08:59 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\foobar2000
[2012.12.17 15:21:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\FreeFLVConverter
[2012.11.04 20:13:31 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gretl
[2012.11.04 20:33:25 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gtk-2.0
[2012.06.08 16:49:28 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\IsolatedStorage
[2012.01.28 22:14:40 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Leadertech
[2013.01.01 15:06:26 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\MySQL
[2013.01.01 19:44:10 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Oracle
[2011.07.26 02:45:15 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Protector Suite
[2013.02.11 17:32:01 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Quantitative Micro Software
[2012.10.12 13:18:57 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\RStudio
[2011.07.26 02:45:16 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Vodafone
[2012.09.28 01:04:48 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\WindSolutions
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---


Gruß R

Nicht so wild. Hast Du PW geändert? Seither keine Mails mehr?

PW geändert, keine Mails mehr, aber ich habe auch keine Kontakte mehr gespeichert.

Warum funktionieren bei mir diese beiden Scanner nicht?

ESET hat ab und zu Macken, SecurityCheck ist ne Zicke

kommt vor

Ich würd sagen, leg Kontakte an, und teste mal, meld dich wieder

okay,

ich habe einige angelegt und schau mal, ob noch etwas passiert.

ich reduziere die Arbeit weitestgehend, aber irgendwann muss ich dann doch mal wieder in einige accounts rein...

ausserdem, ich habe zwei desktop.ini Dateien, die ich vorher nicht hatte. Wie beseitige ich die? auf dem Desktop sind die nämlich nicht allzu sicher.

Gruß, R

Das ist normal, da wir versteckte Dateien anzeigen im Moment. Die verschwinden wieder

Guten Morgen Schrauber,

also keine Mails sind weggegangen. System scheint auch stabil zu laufen.

Ich hatte anfangs vergessen: Ein Kollege hatte ganz anfangs mal irgendeine "*.bat" ausgeführt; ich weiß nicht mehr was genau drin stand:

"@echo:

/ / / / (diverse Buchstaben) und eben den angesprochenen Virus"

hat aber irgendwie nicht viel gebracht.

ich hoffe, da wurde nichts gecrasht.

Könnten wir nochmal sichergehen, dass auch alles wieder beim alten ist?

lG, R

Könnten wir nochmal sichergehen, dass auch alles wieder beim alten ist?

in wiefern?

Sodass ich wieder "unbekümmert" surfen kann a la "überall" einloggen etc.

How To Guide: Remove Win32/Toolbar.Zugo Manually And Thoroughly - Tee Support Blog gemäss der Webseite muss ich hier sogar in der Registry rumpfuschen, damit das hartnäckige Ding vom meinem System verschwindet